PIM weirdness

Unanswered Question
Jun 3rd, 2008


We have a Cat 6509 with Sup720, multicast routing emabled, PIM on relevant interfaces. In troubleshooting a multicast problem, I see the following behavior that I can't explain. I have wireshark running on my PC to watch IGMP, from which I am running both VLC and ConferenceXP, and I have wireshark on a SPAN port on the 6509, looking at the interface facing out, to capture PIM.

If I join a certain multicast group on ConferenceXP,, I see with the 2 instances of wireshark the IGMP join on my PC, and the PIM register on the 6509. However, if I try to join the same group, with VLC, I see the IGMP join, but on the other instance of wireshark where I am capturing pim, the pim join data is malformed, according to wireshark. And, in fact, the data looks like it is all zeroes.

The weird thing is that wireshark reports, in the case of the good pim packet, that the pim checksum is incorrect, but in the case of the malformed pim packet, the checksum is reported to be correct by the wireshark.

I've looked closely at the IGMP packets and don't see any difference between the two joins. No errors in either one.

I'm stumped.



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ebreniz Mon, 06/09/2008 - 08:07

As per theory, IGMP snooping sniff's every multicast pkt to knw the information.

I think ur issue is caused by combination of igmp snooping + huge number of groups.

igmp snooping is useful, so we need to question the huge nuymber of groups.

if you know hich groups you need to carry, you coudl have an IGMP static join, with class map on upsteream interface configured for PIM. this way you will reduce ur groups.

There's also a nice document that goes through some methods for troubleshooting high CPU usage on the 6500 series switches:



This Discussion